54.39.0.165📋 Copy

INTELLIGENCE BRIEFING: IP 54.39.0.165/32

Classification: Moderate Risk – Cloud Infrastructure with High Abuse Subnet Density

---

IP Profile Summary

• Address: 54.39.0.165/32
• Risk Score: 40/100
• Reputation: Moderate Risk
• ASN: 16276 (OVH SAS)
• Organization: Dmytro, Ahrefs Pte Ltd
• Subnet: 54.39.0.0/24 (OVH-CUST-281059683)

Geolocation

• Country: Canada (CA)
• Region: Quebec (QC)
• City: Beauharnois
• GeoConsensus: True (2 sources)
• Note: RTT validation flagged – measured 31ms vs minimum possible 112.6ms for distance, indicating geographic data may be inaccurate

Network Classification

• Infrastructure Type: Cloud Compute (OVH)
• Cloud Provider: OVH
• Hosting: Yes
• CDN/Proxy/VPN: No
• Services: None detected (Firewalled/No Services)
• Open Ports: 0

DNS Resolution

• PTR Hostnames: proxy-ca004-san165.ahrefs.net
• Domain: ahrefs.net
• Forward Resolution: Confirmed
• DNSSEC: Valid
• DNSBL Status: Listed on 1 of 8 threat feeds

Threat Indicators

• Tor Exit Node: No
• Known Attacker: No
• Spam Source: No
• Blacklist Count: 0
• Campaign Indicators: None detected
• Threat Persistence: 0 days

Neighborhood Analysis (54.39.0.0/24)

• Subnet Abuse Density: 0.5703 (HIGH_ABUSE)
• Total Siblings: 256 IPs
• Active Siblings: 230 IPs
• Threat Siblings: 146 IPs
• Inherited Risk: 22
• Risk Distribution: All 100 sampled neighbors scored Medium (40/100)

Observation History

• Total Observations: 25 signals
• Most Recent: 2026-06-23
• Threat Observation Count: 1
• Stability: No ownership changes detected
• Trend: Consistent moderate-risk profile with minimal operator score (0.2174)

Relationship Graph

• Total Relationships: 61
• Primary Link: Same Network (OVH-CUST-281059683)

---

SOC Actionable Intelligence

Assessment: This IP belongs to Ahrefs infrastructure hosted on OVH cloud. The IP itself shows no direct malicious indicators, but operates within a subnet with elevated abuse density (0.5703). The high concentration of threat siblings (146/256) suggests the /24 is heavily utilized for legitimate services alongside potentially abusive endpoints.

Risk Mitigation:

1. Traffic Monitoring: Monitor for anomalous traffic patterns from this subnet; 146 threat siblings indicate elevated neighbor risk

2. Allow List: IP is part of known Ahrefs infrastructure – may be legitimate web crawler or analytics service

3. DNSBL: IP listed on 1 DNSBL – verify with sender reputation tools before blocking

4. No Services: No open ports detected – limited attack surface for direct exploitation

Recommendation: ALLOW with monitoring. This is legitimate cloud infrastructure with no direct threat indicators. Subnet-level risk requires awareness but does not warrant blocking at the IP level. Monitor for behavioral anomalies rather than blocking based on IP alone.

Priority: LOW – Infrastructure IP with no active threat indicators

Last Updated: 2026-06-23

This summary was generated by AI and may contain inaccuracies. Verify critical details independently.